427 Botnet fm qxd

Table 4.3
A Sample of Processes Sometimes Terminated by RBot
regedit.exe
MSBLAST.exe
msconfig.exe
teekids.exe
www.syngress.com
106
Chapter 4 • Common Botnets
Continued
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 106

---

Table 4.3 continued
A Sample of Processes Sometimes Terminated by
RBot
netstat.exe
Penis32.exe
msblast.exe
bbeagle.exe
zapro.exe
SysMonXP.exe
navw32.exe
winupd.exe
navapw32.exe
winsys.exe
zonealarm.exe
ssate.exe
wincfg32.exe
rate.exe
taskmon.exe
d3dupdate.exe
PandaAVEngine.exe
irun4.exe
sysinfo.exe
i11r54n4.exe
mscvb32.exe
Source: CA (www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=39437)
Unexpected Traffic
Once a system is infected, RBot will attempt to connect to the IRC server it
is configured to join.The IRC server, channel, port number, and password
differ among variations, so it is not possible to list them here. Aside from
looking for unknown or suspicious connections or open ports on your
system, you can also look for activity on TCP port 113 (ident). RBot uses this
port for ident services required by some IRC servers.
T
IP
RBot (and many of the other bot programs as well as other malware)
often attempts to connect to network shares and other resources
using the credentials and access rights of the currently logged-in user.
You should use a login with restricted or limited access for day-to-day
tasks and only log in with full administrative privileges when it is nec-
essary. This practice will limit malware’s ability to exploit the privileges
of the logged-in user to spread itself.
www.syngress.com